Multiple Vendor xlock Vulnerability
BID:224
Info
Multiple Vendor xlock Vulnerability
| Bugtraq ID: | 224 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 26 1997 12:00AM |
| Updated: | Apr 26 1997 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq Mailing list by George Staikos <[email protected]> on Sat, 26 Apr 1997. |
| Vulnerable: |
Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3 SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.1 SGI IRIX 6.0.1 XFS SGI IRIX 6.0.1 SGI IRIX 6.0 SGI IRIX 5.3 XFS SGI IRIX 5.3 SGI IRIX 5.2 SGI IRIX 5.1.1 SGI IRIX 5.1 SGI IRIX 5.0.1 SGI IRIX 5.0 IBM AIX 4.2 IBM AIX 4.1 IBM AIX 3.2 HP HP-UX (VVOS) 10.24 HP HP-UX 10.34 HP HP-UX 10.30 HP HP-UX 10.20 HP HP-UX 10.16 HP HP-UX 10.10 HP HP-UX 10.8 HP HP-UX 10.1 0 HP HP-UX 10.0 Debian Linux 1.3 Debian Linux 1.2 Debian Linux 1.1 Debian Linux 0.93 Data General DG/UX 7.0 Data General DG/UX 6.0 Data General DG/UX 5.0 Data General DG/UX 4.0 Data General DG/UX 3.0 Data General DG/UX 2.0 Data General DG/UX 1.0 BSDI BSD/OS 2.1 |
| Not Vulnerable: |
Sun Solaris 2.6_x86 Sun Solaris 2.6 SSH Communications Security SSH 1.2.27 SGI IRIX 6.5 HP HP-UX 11.0 FreeBSD FreeBSD 3.3 Debian Linux 2.0 Data General DG/UX 8.0 BSDI BSD/OS 4.0 BSDI BSD/OS 3.0 |
Discussion
Multiple Vendor xlock Vulnerability
The xlock program is used to lock the local X display until the user supplies the correct password. A buffer overflow condition has been discovered in xlock that may allow an unauthorized user to gain root access.
The xlock program is used to lock the local X display until the user supplies the correct password. A buffer overflow condition has been discovered in xlock that may allow an unauthorized user to gain root access.
Exploit / POC
Multiple Vendor xlock Vulnerability
x
x
Solution / Fix
Multiple Vendor xlock Vulnerability
Solution:
CERT Advisory CA-97.13 in the referance section of this vulnerability has the known fix information.
Solution:
CERT Advisory CA-97.13 in the referance section of this vulnerability has the known fix information.
References
Multiple Vendor xlock Vulnerability
References:
References:
- HP Electronic Support Center for Europe (Hewlett Packard)
- HP Electronic Support Center for US, Canada, Asia-Pacific, & Latin-America (Hewlett Packard)
- IBM Support Databases (IBM)
- Sun Patch Access Page (Sun Microsystems)
- Sun Patches List (Sun Microsystems)
- Sunsolve Online(tm) (Sun Microsystems)